tailwind-animate-v4@2.1.0

Analysis

tailwind-animate-v4 is a combosquat of the real tailwindcss-animate plugin. The package ships a trojanized index.js: the file begins with legitimate Tailwind CSS animation plugin code but appends an eval(atob(...)) payload that executes when the module is required. The obfuscated JavaScript payload captures the require function onto the global scope, sets __dirname and __filename globally, and runs a large obfuscated function. The package.json author is forged to impersonate the real plugin's maintainer. No lifecycle hooks are used — the payload runs at require-time when the package is loaded as a Tailwind CSS plugin.